Description
Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.
Remediation
References
https://akka.io/security/alpakka-kafka-cve-2023-29471.html
https://github.com/akka/alpakka-kafka/issues/1592
Related Vulnerabilities
CVE-2020-5404 Vulnerability in maven package io.projectreactor.netty:reactor-netty
CVE-2020-6457 Vulnerability in maven package org.webjars.npm:electron
CVE-2022-22984 Vulnerability in npm package @snyk/snyk-hex-plugin
CVE-2019-2692 Vulnerability in maven package mysql:mysql-connector-java
CVE-2023-25753 Vulnerability in maven package org.apache.shenyu:shenyu-admin